{"as_of":"2026-08-18T09:22:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:0ff4bc4ff5e862c59b43adce2e1673b2963cbcc5f59888bf87f50a0f865393be","coverage":[{"denominator":45,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":45,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-01T06:54:48.503377Z","state":"measured"},{"denominator":45,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":45,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-18T06:34:40.430872+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.21735/citation-record","integrity":"/paper/2607.21735/integrity","json":"/paper/2607.21735/citation-record.json","paper":"/paper/2607.21735"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.292789Z","title":"Hudson, Ehsan Adeli, et al","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.292789Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:99c363d6320d9e5c40763578adefccecafeef1c4089b0489b7529c6adae29d0b","observation_id":"d88d1232-5dec-4a04-984b-c4b5a8e0ff33","resolution":{"observed_at":"2026-08-01T06:54:48.292789Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.298076Z","title":"Model cards for model reporting","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.298076Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:4a2688f9163822340e09b3aa1457f96d3b6a88ae63eb1bc986ae8d30bc2dda6b","observation_id":"373d399f-b1e6-43d5-8093-c4405b0438c2","resolution":{"observed_at":"2026-08-01T06:54:48.298076Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.302790Z","title":"Holistic evaluation of language models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.302790Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:92308e4042347d5fdac6973030d5afa934c10a1aa93910536553740c814d6d00","observation_id":"1dc17684-f994-410b-aa15-0a01343edefb","resolution":{"observed_at":"2026-08-01T06:54:48.302790Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.307997Z","title":"Gritsenko, et al","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.307997Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:801141b07ef6770af30cd3efbc8a451723781fee5e147528c14873785f54bde0","observation_id":"77c09251-4538-47c7-85cf-fdae96f89c24","resolution":{"observed_at":"2026-08-01T06:54:48.307997Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.312735Z","title":"Feder Cooper, Solon Barocas, Abhinav Palia, Dan Vann, and Hanna Wallach","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.312735Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:e1d6c92524d855b71e06539b8f5a86a0814e4ba2423ab23e2caf878602e197c6","observation_id":"dbb6170d-e3d4-476f-b6a1-7d3af53b54bb","resolution":{"observed_at":"2026-08-01T06:54:48.312735Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.317460Z","title":"The structural safety gener- alization problem, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.317460Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:ce3c310da618bb842b2adf901b845ce4c735201141c4019bdb5b171e38d1962e","observation_id":"bfbf40ef-b0e4-49f6-8f4b-3b6555b6659d","resolution":{"observed_at":"2026-08-01T06:54:48.317460Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.322834Z","title":"Adding error bars to evals: A statistical approach to language model evaluations, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.322834Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:e1f0d9a0dd3f6f739bd2176f0c8b44296edffc6ad8c8b7169d62419d45ca94e0","observation_id":"a2c47ca0-2d57-47cc-a63b-e132dcfd7056","resolution":{"observed_at":"2026-08-01T06:54:48.322834Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.327008Z","title":"Kim and Anthony R","venue":null,"work_id":null,"year":2011},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.327008Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:9c4d9fac1312ce542f0a71d55306f96639cf21628c4fda5f3ee0e3df70e5afe0","observation_id":"3d11f44d-a56b-4035-84e3-33a05813ffa2","resolution":{"observed_at":"2026-08-01T06:54:48.327008Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.331485Z","title":"Prentice","venue":null,"work_id":null,"year":1989},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.331485Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:add91f71d35ab47efe11208ae27619624447973cf4df3ce5d7b7ec701cdac0cd","observation_id":"57a5a564-44a7-4132-ae28-c6dccd5a2e43","resolution":{"observed_at":"2026-08-01T06:54:48.331485Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.336192Z","title":"Safety cases: How to justify the safety of advanced AI systems, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.336192Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:6d6d29a72ef31c86f25bede15748f77136ffe6d34361822e78bd9c2f503db90a","observation_id":"15d7eebd-aa13-47ce-b215-3e3b5db064f5","resolution":{"observed_at":"2026-08-01T06:54:48.336192Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.340824Z","title":"A sketch of an AI control safety case, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.340824Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:4c1f8e0f84feaa9cb9f03c3f47afa877b8e9bb6b340d9292e24c0ba4ff126501","observation_id":"d1c28ae5-00a6-4d28-bbc5-9371f24a0edf","resolution":{"observed_at":"2026-08-01T06:54:48.340824Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.346205Z","title":"Shadish, Thomas D","venue":null,"work_id":null,"year":2002},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.346205Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:74349b3d26f5c9d57d95901a047ad009efbcc2c400708ff29da8308cc5c12c26","observation_id":"bd78ca10-2ea9-4e4b-8876-96ee4677661b","resolution":{"observed_at":"2026-08-01T06:54:48.346205Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.351912Z","title":"Dulberg, and George A","venue":null,"work_id":null,"year":1994},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.351912Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:60ec55d54bd67268f8e1fca942c6c732cc999033d643186de70bfa5aa9c55ab9","observation_id":"8fd1b70a-b96a-4904-8310-6ff63f2a110d","resolution":{"observed_at":"2026-08-01T06:54:48.351912Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.356405Z","title":"Hanley and Abby Lippman-Hand","venue":null,"work_id":null,"year":1983},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.356405Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:231ef54e84ffbf7040f229f3104e42791052bcf8e0d31072b5d0f307160dbb5d","observation_id":"b985ad45-8b24-404f-bd54-efc7efda56bd","resolution":{"observed_at":"2026-08-01T06:54:48.356405Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.360716Z","title":"Brown, and Francis R","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.360716Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:f1b7c393771ce2614e03d80b6423b3ba574fdedce57a93050389862a9f12162a","observation_id":"80f097a5-e73e-4c79-8be4-89db9febbe71","resolution":{"observed_at":"2026-08-01T06:54:48.360716Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.365061Z","title":"XSTest: A test suite for identifying exaggerated safety behaviours in large language models, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.365061Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:234078f098c8e680b58718e930f2b9696c272515239c280269eaf51cf686c7bb","observation_id":"3eef9d01-3c9f-4227-ba1f-356c9a457061","resolution":{"observed_at":"2026-08-01T06:54:48.365061Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.07045","last_updated":"2024-06-24T04:04:21Z","snapshot_observed_at":"2026-08-16T15:00:59.598095Z","submitted_at":"2023-09-13T15:56:50Z","title":"SafetyBench: Evaluating the Safety of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.07045","snapshot_observed_at":"2026-08-01T06:54:48.369854Z","title":"SafetyBench: Evaluating the safety of large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.369854Z"},"links":{"cited_paper":"/paper/2309.07045","citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:1260af41948219a795c7557978523920b6310bd42b834c3c6328f39112e40a63","observation_id":"35546b27-3658-41db-ad14-ecb340c7aaee","resolution":{"observed_at":"2026-08-01T06:54:48.369854Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.374594Z","title":"Zico Kolter, and Matt Fredrikson","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.374594Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:91467bec5d628c93ffae89de18b9c9c973e88fd40cafa83519e6a2fd456ae59f","observation_id":"9876aa84-411b-4b94-828d-1e58b0411666","resolution":{"observed_at":"2026-08-01T06:54:48.374594Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.378992Z","title":"HarmBench: A standardized evaluation framework for automated red teaming and robust refusal, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.378992Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:481c9095f4232b74c5ae57dcb19e6dcacec2d0611ecaaadf5619c725883a3b2c","observation_id":"672f8c41-867c-4c87-b89a-54f65793a14c","resolution":{"observed_at":"2026-08-01T06:54:48.378992Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.383131Z","title":"A StrongREJECT for empty jailbreaks, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.383131Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:a62771427912245e882908ce4d0f0b66c4cd262fdd61e5bb7bf2148f3a02dd4c","observation_id":"5b2fab8a-2f47-4b04-9ebd-f839dc927756","resolution":{"observed_at":"2026-08-01T06:54:48.383131Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.387331Z","title":null,"venue":null,"work_id":null,"year":1934},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.387331Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:1ecbf3423e517acebd2c7f0da88dd7260852214b41e780c1164e796ca3a5485c","observation_id":"2d6737ef-b31b-4d9d-8da0-0885059f99a3","resolution":{"observed_at":"2026-08-01T06:54:48.387331Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.391557Z","title":"John Wiley and Sons, New York, 1965","venue":null,"work_id":null,"year":1965},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.391557Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:141bd0c250966e66415e84aa6cd61db6316492958fc114a063f2a1c4d403d030","observation_id":"f37e2ad5-f7d1-4f60-bcc3-33ae49081e2d","resolution":{"observed_at":"2026-08-01T06:54:48.391557Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.395950Z","title":null,"venue":null,"work_id":null,"year":1975},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.395950Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:16303a6df54efaf5ed1ba13b3cd63f7d54caa8cba35b76b736e0636597fac985","observation_id":"6467b702-3a36-4728-acd7-6519488f324e","resolution":{"observed_at":"2026-08-01T06:54:48.395950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.400904Z","title":"Model card and evaluations for claude models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.400904Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:e1dcd412e9ba88a1363aeb4e386d721029fd62f204e3a9bd94ad21378a7f0e67","observation_id":"ec26b57d-c8a9-40b2-a2eb-5fbf0aad3434","resolution":{"observed_at":"2026-08-01T06:54:48.400904Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.406066Z","title":"Sentence-BERT: Sentence embeddings using siamese BERT-networks","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.406066Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:1e9c11effdd7c219f195e9f54c378e88f768227ff82e6794dfbe1561d2a4643e","observation_id":"2743c202-13bb-48ad-9ec3-9d6c206cc841","resolution":{"observed_at":"2026-08-01T06:54:48.406066Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.410572Z","title":"LMSYS-Chat-1M: A large-scale real-world LLM conversation dataset, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.410572Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:aa40d43b58e9f494a5403c3b5e9b20034fdcf1409637e82bce218d75487b48bf","observation_id":"9382bd33-680a-4971-a2c4-76cec48fe29c","resolution":{"observed_at":"2026-08-01T06:54:48.410572Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.415116Z","title":"Borgwardt, Malte J","venue":null,"work_id":null,"year":2012},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.415116Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:a9b1577eb206ada888bf9e4bf8827bff52d5e969f36f09e7ebbbe9a7c994965d","observation_id":"211ea424-422f-4e2d-b5a6-6eaec1d95e12","resolution":{"observed_at":"2026-08-01T06:54:48.415116Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.420308Z","title":"UMAP: Uniform manifold ap- proximation and projection for dimension reduction, 2018","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.420308Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:1c1c5252329baf7769074885d1a84491a326e79b943e833645b8a4c7bb91bb1b","observation_id":"d26b55e6-5b01-46cc-9a5f-dc8f24d4fc7a","resolution":{"observed_at":"2026-08-01T06:54:48.420308Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.426517Z","title":"Choquette-Choo, et al","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.426517Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:0371e571e23f7b7ca393c7515b8edde5a8b4358c4a93d188e7d5756706675607","observation_id":"942aafff-26e4-42eb-bb8c-7f19f5c9ef46","resolution":{"observed_at":"2026-08-01T06:54:48.426517Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.434251Z","title":"AutoDAN: Generating stealthy jailbreak prompts on aligned large language models, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.434251Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:de4ebcd6753372efcaa91492eac9d58a9a151278fb623a99d4169e7c3f4f8769","observation_id":"1a80966c-fb58-438f-9e1b-4b4c63f0615c","resolution":{"observed_at":"2026-08-01T06:54:48.434251Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.440217Z","title":"Does refusal training in LLMs generalize to the past tense?, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.440217Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:4c3fd066f5e2ddaa0b952eab14a7c6e74571e16f6c1e9d335e888617f044e1b1","observation_id":"7130a205-44c7-4b3b-a148-c24277ff8fe8","resolution":{"observed_at":"2026-08-01T06:54:48.440217Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.446386Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.446386Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:be4e1507508d6ac6ee49c7cd64e3f9e0a5a9f6ad52d4aeb3b44335e98671c229","observation_id":"40a1a1e4-0715-4b4e-9a2d-87dba58c35be","resolution":{"observed_at":"2026-08-01T06:54:48.446386Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.451336Z","title":"Tree of attacks: Jail- breaking black-box LLMs automatically, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.451336Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:5ad7bb50b548581ce725c8ef2da6639b91de32709dc67785f94db9ab5e1c81e3","observation_id":"0eb41bd9-2072-4694-a6f9-e520ee816c51","resolution":{"observed_at":"2026-08-01T06:54:48.451336Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.455476Z","title":"Ignore previous prompt: Attack techniques for lan- guage models, 2022","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.455476Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:fe5a4796db30598d7a1e75be380e9af3442006149c6d5f079daf57a4ee34374f","observation_id":"652b69c2-d087-4678-bab5-18eb0e197c1d","resolution":{"observed_at":"2026-08-01T06:54:48.455476Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.460464Z","title":"GPT-4 technical report, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.460464Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:c434dac3dd0d024ae4bde0c269278c38731618e572388127e0ef6130a411a8a2","observation_id":"66ea6870-7599-4e90-8976-8d8e4930c06f","resolution":{"observed_at":"2026-08-01T06:54:48.460464Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.464794Z","title":"GPT-4o system card, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.464794Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:e12b7258ebf14af4a77b17dc4af5aaffb342715cbcc846425916318217d64271","observation_id":"d73ba15e-e881-40ee-a011-21c5730c57e0","resolution":{"observed_at":"2026-08-01T06:54:48.464794Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.469031Z","title":"The claude 3 model family: Opus, sonnet, haiku","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.469031Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:8cf4a9e574b8e48d825842964ed13ccf324290804db47cfaf76f409068e59738","observation_id":"6aeced3a-b254-4c43-9259-387270fb29bd","resolution":{"observed_at":"2026-08-01T06:54:48.469031Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.473574Z","title":"System card: Claude opus 4 and claude sonnet 4","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.473574Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:a2f33a885b44c9ee6c955bce23da822f2f037a65e5effb219cb2ac69c91f2285","observation_id":"b8d0024a-c2f1-4657-910c-c039b8fdf02f","resolution":{"observed_at":"2026-08-01T06:54:48.473574Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.478226Z","title":"Gemini: A family of highly capable multimodal models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.478226Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:3223972d5eff59979473dcd7346a4af76c9e9ec633e75980332213b70992a6b9","observation_id":"9a976dac-022b-4d95-a2b6-79f8b8d1df37","resolution":{"observed_at":"2026-08-01T06:54:48.478226Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.482631Z","title":"Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.482631Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:12f2422e11ed6dd0067641d2f95dd3e912303a65b39e1b6eabe8078f172d09a1","observation_id":"43d610c4-3c39-4a56-b54c-3403433df20b","resolution":{"observed_at":"2026-08-01T06:54:48.482631Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.486674Z","title":"Llama 2: Open foundation and fine-tuned chat models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.486674Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:a2933747d598041557c6c40d2fe5c988b7f097249f9c5e6e5147c5c39a0c216f","observation_id":"4954885d-4486-4200-a812-e363906d50eb","resolution":{"observed_at":"2026-08-01T06:54:48.486674Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.490984Z","title":"The llama 3 herd of models, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.490984Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:53d57b235131ea6ee029ebdadb0ddd1724478bad98780a5c6166297b4951bd6e","observation_id":"edfa1227-57cf-4042-8c31-f4869976d8f4","resolution":{"observed_at":"2026-08-01T06:54:48.490984Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.495168Z","title":"Responsible scaling policy","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.495168Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:0e16c498143ecbea781a662329ce5d82c366537a40ab752a3d7fb177fae34eaf","observation_id":"56e9109f-1aee-4983-9afd-fa36d97d3de9","resolution":{"observed_at":"2026-08-01T06:54:48.495168Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.499159Z","title":"Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned, 2022","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.499159Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:94be8bf94adaaae8240b12cbf7c45a54254787c875421ca943eb20bce9fd6b76","observation_id":"2bacd9a9-bb05-4f97-a16d-74edf5a71c39","resolution":{"observed_at":"2026-08-01T06:54:48.499159Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T06:54:48.503377Z","title":"Red teaming language models with language models, 2022","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove","version":2},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-01T06:54:48.503377Z"},"links":{"citing_paper":"/paper/2607.21735"},"observation_digest":"sha256:7efacf4c33027c9b1e6cb9803d340b2a2aff9b805609dc88909a48a77c7e4fbf","observation_id":"8811b220-1865-4f65-acbe-2ba4172ec09b","resolution":{"observed_at":"2026-08-01T06:54:48.503377Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.21735","last_updated":"2026-07-30T16:46:31Z","latest_version":2,"primary_category":"cs.AI","snapshot_observed_at":"2026-08-16T11:47:45.619224Z","submitted_at":"2026-07-23T18:34:12Z","title":"What AI Red-Team Evaluations Can and Cannot Prove"},"reference_resolution":{"displayed":45,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":45,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":45},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"thesis":"As of 18 August 2026, this Paper Citation Record lists 45 of 45 outbound references and 0 inbound Pith citation observations for arXiv:2607.21735."}